Method of simulating network communications

ABSTRACT

A method for simulating network communication sessions is disclosed. A control engine sequences the packets using a protocol stack or by putting the packets into a sorted list. A simulation engine acquires the packets until a request packet or other initiation packet is received. The simulation engine feeds the request packet to a display engine that has the ability to treat the request packet as though the display engine itself originated the request (or initiation) packet. The simulation engine then sends the response packets relating to the request to the display engine, and the display engine uses those packets to simulate the display of the network communication session substantially in the form of the original communication.

BACKGROUND OF THE INVENTION

[0001] This invention relates generally to processes for simulatingnetwork communications using captured network packets and, inparticular, world wide web browsing sessions that use the TCP/IPcommunication protocol.

[0002] Computer networks have been a boon to information sharing inmodem society. Computer users are able to access network resources foruseful data and to communicate with other computer users. These networksinclude local area networks, company wide networks, and wide areanetworks including the vast world wide web.

[0003] Computer users access and exchange massive amounts of data withother users and with network servers and web servers, including email,instant messaging, text files, web pages, and a variety of binaryobjects such as audio and video. Networks and the worldwide web havedeveloped tremendously over the last few years to provide constantlychanging and updated information and even the ability to dynamicallycreate and distribute web pages and other information from real-timedata. While real-time changes and dynamic information provide manybenefits, there is no ability to simulate networks communications asthey occur or after the fact.

[0004] The ability to simulate a network communication from captureddata is useful because it allows review of what actually occurred, or isoccurring, during a network communication. Although the ability existsto download the content and structures of network files and web sites,there is no ability to recreate or simulate an actual communicationsession between a computer user and network sources, whether as itoccurs or after the fact. Therefore a need has arisen to capture networkcommunications as they occur, to store those communications, and toreconstruct and simulate the actual network communication as it takesplace, or after the fact, with respect to identity of user, timing, andcontent.

SUMMARY OF THE INVENTION

[0005] According to the present invention, a method is provided thatsatisfies the need to simulate actual network communications. The methodpermits control of the display of the content of actual web sessions,the ability to control the display of web sessions, and recreation offiles transported over a network. The method may be used to recreate andsimulate both previously stored and real-time network communications.

[0006] The first step is to collect or capture the packets in transitover a network. This may be accomplished using known technology, such asa network packet capture device or sniffer. The packets may be stored ona storage medium, such as a hard drive, for analysis and use, and thepackets may be used to simulate a network communication session as itoccurs, or previously occurred, on the network.

[0007] Using a computer processor, a portion of the packets areselected, typically by selecting packets captured by the sniffer in agiven time interval. The selected packets are then read sequentiallyfrom the storage, that is, a first packet is read and decoded. Packetsare read and decoded until a request packet or other communicationssession initiation packet is found. A process for sorting the packetsrelating to the communication in question starts once an initiationpacket or request packet is found.

[0008] The sorting or sequencing process may be performed in at leasttwo different ways. First, the packets may be sorted onto a protocolsorted list. If the packet is either a request or a response, the packetis added to the protocol sorted list, preferably using the TransactionControl Protocol/Internet Protocol (“TCP/IP”) address and port number ofthe computer sent or received the packet. The next packet is then readand decoded, and processed in the same way, until all of the selectedpackets have been processed.

[0009] Alternatively, the packets are sorted using a protocol stack,such as a TCP/IP stack. In this embodiment, if a given packet is insequence, the packet is passed on to a display engine. If not, thepacket is added to the protocol stack and held there until all thepackets that are earlier in sequence have been passed to the displayengine. At that point, the packet is sent from the protocol stack to thedisplay engine.

[0010] The sequenced packets, having been passed to the display engine,are used by the display engine to recreate the network communication anddisplay the communication on a computer monitor. This display may bemerely a display of what the user saw in the communication, or a displayof both the user's prior display and other control information. Thecontrol information may be derived from the network communicationsession to aid in navigation. Inclusion of control information permits auser to move back and forth through the network communication, ifdesired.

BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Other features and advantages of the present invention will beapparent from the following Detailed Description taken in conjunctionwith the accompanying Drawings, in which:

[0012]FIG. 1 depicts a packet capture engine in operation;

[0013]FIG. 2 depicts an overview of the simulation method and apparatusaccording to the present invention;

[0014]FIG. 3 depicts a protocol sorted list of packets;

[0015]FIG. 4 depicts a flowchart of the process for sorting packets intoa protocol sorted list according to one embodiment of the method of thepresent invention;

[0016]FIG. 5 depicts a flowchart of the process for using a protocolstack for sequencing packets according to a second embodiment of themethod of the present invention;

[0017]FIG. 6 depicts a flowchart of the process utilized by a simulationengine according to the method of the present invention;

[0018]FIG. 7 depicts graphical representation of how a simulated networkcommunication session may be displayed according to an alternateembodiment of the present invention;

[0019]FIG. 8 depicts a flow chart of a display control system accordingto the method of the present invention; and

[0020]FIG. 9 depicts a graphical representation of how information abouta simulated network communication may be displayed according to analternate embodiment of the present invention.

DETAILED DESCRIPTION

[0021] According to the present invention, a method is provided thatpermits simulation and display of the content of actual web sessions andthe ability to control the display of stored web sessions and othernetwork communications. The method may be used to simulate and displayboth previously stored and real-time network communications. In effect,network communications may be captured and displayed as they appeared,or substantially as they appeared, in the original network communicationsession.

[0022]FIG. 1 depicts a network communication session 102 comprisingmultiple requests and responses between a first computer 100 and asecond computer 101. Typically, network communications are conducted bytransmitting packets of data across the network. The packets may containdata to be transmitted as well as addressing, sequence, and otherprocess control information.

[0023] The first computer 100 sends a request to the second computer 101by way of a packet or series of packets. A request packet is any packetthat solicits a response, but also includes packets that initiateinstant messaging, broadcast communications or other push technologies,or any other packet used to initiate a network communication. The secondcomputer 101, which is typically a server computer, receives the packetor packets, decodes the request, and sends one or more response packetsfor the first computer to receive, decode, or process, as appropriate.The first or second computer may then send additional requests, therebycontinuing the communication session, or the session may terminate.

[0024] To simulate the network communication session 102, the packetsmust first be captured as is known in the art. A network tap device 103,such as an Ethernet card set to promiscuous mode or a wireless networkcapture device, intercepts the packets being transmitted during thenetwork session 102. A packet capture engine 104 is used to capture theraw data packets that are being communicated during the networkcommunication session 102. If the network communication is to bereviewed at a later time, the captured packets may be stored on astorage medium 105. The process of capturing network packets is known inthe art. Capture engines may be software, firmware, or hardware.Commonly available software capture engines include the Sniffer fromNetwork Associates, the Lanalyzer from Novell, a Linux program calledEthereal and EtherPeek from WildPackets.

[0025] Typically, the packets are captured in a chronological fashionwithout regard to content or type. All or some portion of the capturedpackets may be selected for sorting and processing according to themethod of the present invention. For instance, the portion may beselected by taking a block of packets captured during a specified timeinterval or by IP address or port number.

[0026] The selected packets 200 are then sorted or sequenced. Asdepicted in FIGS. 2, 3 and 4, according to one embodiment of theinvention, a control engine 201 sorts the selected packets 200 into aprotocol sorted list 300. The control engine 201 acquires selectedpackets 200 either from a live communication session or from theoptional storage medium 105. The control engine decodes each of theselected packets 200 into its respective protocol. Typically, this willbe a TCP/IP decode, as is known in the art.

[0027]FIG. 4 depicts a flow chart of the process for sorting theselected packets 200 into the protocol sorted list 300 as shown in FIG.3, which depicts the protocol sorted list 300 including packets P1through P9. A first packet P1 is read; if a decode for the protocol ofthe first packet P1 exists, the packet is decoded. If the first packetP1 is not needed for the subsequent simulation of the networkcommunication session 102, the packet may not be included in theprotocol sorted list 300. For example, a DNS (Domain Name Service)lookup request packet, an error packet, or corrupted packet may not beincluded.

[0028] The first packet P1 is then checked to determine if it is eithera request or response type packet. If it is a request or responsepacket, the first packet P1 is added to the protocol sorted list 300based on the IP address and port number (or other protocol indicia) ofthe first packet. The next packet P2 is then read, decoded, checked todetermine if it is a request or a response packet, and added to theprotocol sorted list 300 based on the IP address and port number of thepacket P2.

[0029] In the same fashion, each of the selected packets 200 aresequentially read, decoded, checked and added to the protocol sortedlist 300 until the last packet has been retrieved, read, decoded andadded to the protocol sorted list. As depicted in FIG. 3, the protocolsorted list 300 groups the packets P1 through P9 from the selectedpackets 200 into a series of linked lists 301 based on the IP addressand port number of the packets and in chronological order as the packetswere received. Although it is presently contemplated that, in thisembodiment, it is preferable to sort the packets by IP address and portnumber, the selected packets 200 may be sorted by other indicators, suchas port only or IP address only, the MAC (Media Access Control) addressfrom the network interface card, the UDP (User Datagram Protocol) port,or an IPX address. Furthermore, in addition to HTTP request/responsepackets, other request/response, local network protocols, or Internetprotocols may be used. Examples of such other protocols include Novell'sIPX/SPX protocol, the secure HTTPS protocol, and the File TransferProtocol (“FTP”).

[0030] According to another, preferred embodiment of the invention,rather than sort the selected packets 200 into a protocol sorted list300, the packets are sequenced using a TCP/IP or other protocol stack202. As depicted in the flow chart shown in FIG. 5, the control engine201 acquires a first selected packet, either from a live communicationor from the storage medium 105. The control engine determines whetherthe packet does not meet given criteria, such as whether the packet iscorrupt, is not needed for simulation, is of zero length, or other suchchecks. If the packet satisfies the necessary criteria, the controlengine reads the next packet.

[0031] If the given criteria are met, the control engine sends thepacket 201 to the protocol stack 202. If the packet is in propersequence, the control engine passes the packet on to a simulation engine204 or buffers the packet for later transmission after a set of relatedpackets have been buffered. The protocol stack 202 may buffer packetsuntil all of a given set of packets have been sequenced. Thus, theprotocol stack 202 may ensure that packet sets are sent to thesimulation engine 204 in a complete and efficient manner.

[0032] If the packet is in sequence, the process continues by checkingwhether the next sequential packet is available on the protocol stack202. If the packet is out of sequence, the control engine 201 checks tosee if there is an overflow or other error on the stack 202. If not, thecontrol engine 201 checks to determine whether the next packet insequence is on the stack. If the next sequential packet is on the stack,the control engine 201 passes that packet on to the simulation engine204. If the next packet in sequence is not on the stack, the next packetfrom the selected packets 200 is read and the process continues asdescribed.

[0033] If there is an overflow or other stack error, the control engineproduces an error message, and the option of continuing the process orterminating the process is provided. If the process is continued, eitherthe protocol stack 202 is scrubbed to eliminate the minimum number ofout of sequence packets or the out of sequence packets are passed to thesimulation engine 204. The control engine 201 then checks to see if thenext sequential packet is on the stack and continues as described above.As a result of these error checking and handling processes, each of thepackets included in the selected packets 200 is sent to the simulationengine 204 in as close to the proper sequence as is feasible.

[0034] Although the sequenced packets may be stored for later analysis,it is preferable to perform the sequencing and the simulation inparallel. That is, while the packets are being placed in the propersequence either by creating a protocol sorted list 300 or using aprotocol stack 202, the simulation engine 204 simultaneously acquiresthe properly sequenced packets. Simultaneous processing increases thespeed with which a simulation may be rendered.

[0035] As shown in FIGS. 2 and 6, the simulation engine 204 acquirespackets from the control engine 201 until a first request packet 203 orother initiation packet is found. Those packets acquired before aninitiation packet is found are not processed, as they must relate to acommunication for which not all the packets are contained within theselected packets 200. The first request packet 203 (or other initiationpacket) is stored in a request packet store 205 for use when processingresponse packets relating to that request packet.

[0036] The request packet 203, or information contained in the requestpacket, is also fed to a display engine 206. The request packet is usedto cause the display engine to receive and process responses to therequest as though the display engine had sent the request. The displayengine 206 is preferably a web browser that has been modified to acceptan external request packet and process that packet as if it hadoriginated in the web browser.

[0037] The simulation engine 204 acquires the subsequent packets fromthe control engine 201. If the packets are neither request (orinitiation) packets nor response packets, that is, if they are notnecessary for simulating the network communication session 102, thepackets are discarded or held pending processing of another networkcommunication session. If the next packet acquired is another requestpacket, for example because there was no response to the first request,the next request packet is stored in the request packet store 205, andthe process continues. Alternatively, request packets and associatedresponse packets may be stored and displayed when all response packetsto a given request have been received.

[0038] If, after storing a request packet in the request packet store205, a response packet 208 is received, the simulation engine 204determines whether the packet is of a type that can be interpreted bythe display engine 206. If so, the packet is sent directly to thedisplay engine 206, which interprets the packet as though it is beingreceived as part of an ongoing network communication session (that is,one that was initiated by the display engine itself). The simulationengine 204 continues to acquire response packets until a displayablepage is complete, and those packets have been sent to the display engine206 for display.

[0039] If the response packet is not of a type that may be interpretedby the display engine 206, the simulation engine 204 may create aprotocol specific display page. In doing so, as depicted in FIG. 6, thesimulation engine 204 continues to acquire response packets and usethose packets to build the protocol specific display page, until all ofthe packets needed for that page have been acquired and processed. Atthat point, the protocol specific display page is passed on to thedisplay engine 206 or to some other display program or process. For someprotocol specific display pages, a traditional web browser will not beable to render the page; in that case, the page may be sent to anotherdisplay program or process that is capable of rendering the page.

[0040] As the simulation engine 204 processes packets, the fileinformation from those packets is being sent to, or generated by, thedisplay engine 206. Preferably, the display engine 206 includes a localcaching capability and uses that local cache to store the fileinformation as it is received. Typically, this will be the cache of theweb browser or other display program. Alternatively, the simulationengine 204 may create its own cache 207 and store the file informationin that cache, and the display engine 206 may be modified to use thatcache 207 for displaying the page.

[0041] Once a page has been completed, the page is displayed on acomputer monitor 209. As depicted in FIG. 7, preferably the actual webpage 700 (or other visualization) is displayed by the display engine206. In one embodiment of the invention, the user is provided with aseries of command buttons 701 to be used to control the display process.In this embodiment, and as depicted in FIG. 8, at any point during thedisplay process, the user may select a command button 701 to control thedisplay of the network communication session 102. For instance, the playcommand button 701 starts a timer and displays the web pages in a slideshow format using pre-determined time intervals or the original viewer'stime intervals as described below.

[0042] As further depicted in FIG. 7 and shown in the flow chart of FIG.8, other command buttons 701 allow the user to display the next page,previous page, first page, last page, or to stop the display of thenetwork communication session 102 in a manner analogous to the way auser controls a web browser during a live session. The exit commandbutton 702 allows the user to terminate the simulated display. Othercommand buttons may be included to increase user control of the displaysimulation process. The URL display box 703 identifies the address ofthe web page being displayed.

[0043]FIG. 9 depicts an alternative method of how a networkcommunication session 102 that has been simulated could be displayedwithin a web browser or other display program. A master display 900 isproduced by the display engine 206 and includes display of various datarelating to the selected packets 200 in the network communicationsession 102. As depicted in FIG. 9, the web page window 901 of themaster display 900 is used to display a web page, as well as other dataas described above. The web page window 901 is a scrollable area used todepict a full web page, if any, associated with the networkcommunication session 102 being simulated. As an example, FIG. 9 depictsan HTTP network communication session 102.

[0044] Beneath the web page window 901 is a packet window 902, which isa one line description of one or more packets. A column bar 903identifies the information being displayed in each packet, such as aserialized packet number, source address and port, destination addressand port, and details concerning the nature and content of the packet.The column bar 903 may be configured by the user to add, delete,rearrange, or resize the various column descriptions.

[0045]FIG. 9 also depicts a packet decode window 904 that is used topresent a complete decode of a selected packet 905. The user may selecta [+] to expand the decode or a [−] to collapse the decode, as istypical in a hierarchical tree display. The user may also selectinformation in any of the expanded limbs of the decode tree. When a userselects decoded information in the tree, the associated data ishighlighted in a packet dump window 906 located beneath the packetdecode window 904.

[0046] The packet dump window 906 allows the user to view the raw dataassociated with each packet. The packet dump window 906 displays ahexadecimal representation 907 of the data in a packet. A correspondingtext representation 908 of the data is also displayed on the right sideof the packet dump window 906.

[0047] When the user highlights a selected packet 905 in the packetwindow 902, the packet decode window 904 and packet dump window 906 areupdated to display the relevant information relating to that packet 905.The user may also select information in the packet decode window 904 andthe data contained in the selected packet will be highlighted within thepacket dump window 906 in both the hexadecimal representation 907 andthe corresponding text representation 908. As a result, a user mayquickly navigate through the web pages, packets, and data captured fromthe packets of the network communication session 102. If a user viewsanother web page, the master display 900 is updated by displaying theweb page in the web page window 901, the first packet becomes theselected packet 905, and the other windows are updated accordingly.

[0048] As depicted in FIG. 9, each of packet window 902, packet decodewindow 904, and packet dump window 906 preferably have a dockable bar909 on the left side. The dockable bar 909 allows a user to move,remove, and “dock” that is, connect, the respective windows to themaster display 900. A user may also render the display area as anindependent window by double clicking on the dockable bar 909.

[0049] As a network communication session 102 is being processed, visualrepresentations of the session are displayed on the computer monitor209. The display engine 206 or other display program may also processstream data such as video or audio, which may require additionalsoftware (such as a video display program) or hardware (such as a soundcard, amplifier, and speakers). The browser or display program thenawaits a response from the user, or until a user-determined timeoutoccurs.

[0050] If a timeout occurs before any user response is made, thesimulation engine 204 continues to process the next page as describedabove. Once the last page included in the selected packets 200 has beendisplayed, the timer is stopped and the system will wait indefinitelyfor user input after displaying the last page. During a real-timesimulation, selected packets 200 are constantly being provided to thecontrol engine 201, and thus the simulation engine 204 continuesprocessing until the user stops or exits the program. Real-timesimulation allows a user to view the network communication session 102virtually simultaneously with the live network communication session.The simulated pages or the underlying files may also be simultaneouslystored to allow later review of the network communication session 102.

[0051] In another embodiment of the present invention, during thesimulation process the display engine 206 reads the time stampsassociated with each packet retrieved from the stored packets. Byreading and decoding those time stamps, the time interval betweenpackets, and thus the interval between files reconstructed from thosepackets, may be computed. This time differential information may then beused (instead of user defined commands or a time-out) automatically toadvance the display from page to page in the same order and using thesame timing as in the original network communication session. Typically,such a sequence would be initiated by use of a play command button 701.

[0052] In another embodiment of the invention, a cache server may beused to allow more complete simulation of the communication. A cacheserver is a computer, typically a separate and dedicated computer, thatstores files and other information from prior network communicationsessions for later retrieval. This is useful because certain files maynot be part of a given network communication session because the useraccessed those files from a local cache. A cache server may cumulativelystore files from various communication sessions so that those files areavailable during a simulation in a manner similar to the way the userretrieves such files from a local cache.

[0053] It will be obvious to those of skill in the art that the methoddescribed may be modified to produce different embodiments of thepresent invention. Thus, the present invention has several advantagesover the prior art without sacrificing the advantages of the prior art.Although different embodiments of the invention have been illustratedand described, various modifications and changes may be made by thoseskilled in the art without departing from the spirit and scope of theinvention.

1. A method for simulating network communications traffic comprising thesteps of: capturing network packets by: attaching a network capturedevice to a network; using the network capture device to capture networkpackets as the packets are passed across the network; storing theplurality of network packets on a mass storage device in chronologicalorder; selecting a portion of the captured network packets based on afirst predetermined set of criteria; sequencing the selected packetsusing a predetermined process; simulating a network communicationsession by a process comprising the steps of: acquiring sequencedpackets that are associated with the network communication until a firstrequest packet is detected; feeding the first request packet to adisplay engine; acquiring a next sequenced packet; if the next sequencedpacket is a response packet produced in response to the first requestpacket, determining whether the packet is of a type that may beinterpreted by the display engine and either: if the next sequencedpacket is of a type that may be interpreted by the display engine,sending the next sequenced packet to the display engine and acquiringadditional response packets until all of the packets responding to thefirst request packet have been sent to the display engine; or if thenext sequenced packet is not of a type that may be interpreted by thedisplay engine, initiating the creation of a visualization of theinformation in the next sequenced packet and acquiring additionalresponse packets until all of the packets responding to the firstrequest packet have been incorporated into the visualization, and thensending the visualization to the display engine.
 2. The method of claim1 wherein the predetermined process comprises the steps of: (a) decodinga first packet from the selected packets; (b) if the first packetrelates to a request or to a response, adding the packet to a sortedlist corresponding to a second predetermined set of criteria that aresatisfied by the packet; and (c) repeating steps (a) and (b) onadditional captured packets until all packets relating to the firstpredetermined set of criteria have been sequenced.
 3. The method ofclaim 1 wherein the predetermined process comprises the steps of:reading a first selected packet; determining whether the first selectedpacket meets a second predetermined set of criteria; if the selectedpacket meets the second predetermined set of criteria, determiningwhether the packet is out of sequence; if the packet is not out ofsequence, sending the packet to the simulation engine; if the packet isout of sequence, adding the packet to a temporary store; repeating thesteps of reading packets, determining whether the second set of criteriais met, and sending the packets to the simulation engine or addingout-of-sequence packets to the temporary store; as packets in thetemporary store fall into proper sequence, sending the properlysequenced packets to the simulation engine; and each time a packet isadded to the temporary store, testing the temporary store for anoverflow condition and, if an overflow condition is detected, generatingan error message.
 4. The method of claim 1 further comprising the stepsof: acquiring additional request packets from the sequenced packets; andrepeating the steps of acquiring sequenced packets and sending thesequenced packets to the display engine until all of the packetsresponding to the additional request packets have been sent to thedisplay engine.
 5. The method of claim 1 further comprising the step ofusing the display engine to display a visual representation of at leasta portion of the network communication on a computer monitor.
 6. Themethod of claim 1 further comprising the step of using the displayengine to display on a computer monitor at least one of: a hexadecimalrepresentation of the content of at least one packet; a decode of atleast one packet; a listing of packets associated with the networkcommunication; a graphic representation of request and response packetsassociated with network communication; and a composite visualreconstruction of any text or graphic information contained in at leastone packet.
 7. The method of claim 5 further comprising the step ofproviding a user with a means of controlling the display of the networkcommunication.
 8. The method of claim 5 further comprising the step ofpermitting a user to control the display the network communication byselecting a command to implement at least one of the followingoperations: playing display pages in chronological order; playingdisplay pages in chronological order using a predetermined timingsequence; stopping the playing of display pages; going to a next displaypage; going to a previous display page; going to a first display page;going to a last display page; or going to a user-selected display page.9. The method of claim 1 wherein the first predetermined set of criteriaincludes the address of at least one computer connected to the network.10. The method of claim 1 wherein the first predetermined set ofcriteria includes specifying a predetermined time interval.
 11. A methodfor simulating network communications traffic comprising the steps of:sequencing selected packets from a network communication using apredetermined process; simulating a network communication session by aprocess comprising the steps of: acquiring sequenced packets that areassociated with the network communication until a first request packetis detected; feeding the first request packet to a display engine;acquiring a next sequenced packet; if the next sequenced packet is aresponse packet produced in response to the first request packet,determining whether the packet is of a type that may be interpreted bythe display engine and either: if the next sequenced packet is of a typethat may be interpreted by the display engine, sending the nextsequenced packet to the display engine and acquiring additional responsepackets until all of the packets responding to the first request packethave been sent to the display engine; or if the next sequenced packet isnot of a type that may be interpreted by the display engine, initiatingthe creation of a visualization of the information in the next sequencedpacket and acquiring additional response packets until all of thepackets responding to the first request packet have been incorporatedinto the visualization, and then sending the visualization to thedisplay engine.
 12. The method of claim 11 further comprising the stepsof: attaching a network capture device to a network; using the networkcapture device to capture network packets as the packets are passedacross the network; storing the plurality of network packets on a massstorage device in chronological order; and selecting a portion of thecaptured network packets based on a first predetermined set of criteria.13. The method of claim 11 wherein the predetermined process comprisesthe steps of: (a) decoding a first packet from the selected packets; (b)if the first packet relates to a request or to a response, adding thepacket to a sorted list corresponding to a second predetermined set ofcriteria that are satisfied by the packet; and (c) repeating steps (a)and (b) on additional captured packets until all packets relating to thefirst predetermined set of criteria have been sequenced.
 14. The methodof claim 11 wherein the predetermined process comprises the steps of:reading a first selected packet; determining whether the first selectedpacket meets a second predetermined set of criteria; if the selectedpacket meets the second predetermined set of criteria, determiningwhether the packet is out of sequence; if the packet is not out ofsequence, sending the packet to the simulation engine; if the packet isout of sequence, adding the packet to a temporary store; repeating thesteps of reading packets, determining whether the second set of criteriais met, and sending the packets to the simulation engine or addingout-of-sequence packets to the temporary store; as packets in thetemporary store fall into proper sequence, sending the properlysequenced packets to the simulation engine; and each time a packet isadded to the temporary store, testing the temporary store for anoverflow condition and, if an overflow condition is detected, generatingan error message.
 15. The method of claim 11 further comprising thesteps of: acquiring additional request packets from the sequencedpackets; and repeating the steps of acquiring sequenced packets andsending the sequenced packets to the display engine until all of thepackets responding to the additional request packets have been sent tothe display engine.
 16. The method of claim 11 further comprising thestep of using the display engine to display a visual representation ofat least a portion of the network communication on a computer monitor.17. The method of claim 11 further comprising the step of using thedisplay engine to display on a computer monitor at least one of: ahexadecimal representation of the content of at least one packet; adecode of at least one packet; a listing of packets associated with thenetwork communication; a graphic representation of request and responsepackets associated with network communication; and a composite visualreconstruction of any text or graphic information contained in at leastone packet.
 18. The method of claim 16 further comprising the step ofproviding a user with a means of controlling the display of the networkcommunication.
 19. The method of claim 16 further comprising the step ofpermitting a user to control the display the network communication byselecting a command to implement at least one of the followingoperations: playing display pages in chronological order; playingdisplay pages in chronological order using a predetermined timingsequence; stopping the playing of display pages; going to a next displaypage; going to a previous display page; going to a first display page;going to a last display page; or going to a user-selected display page.20. A method for simulating network communications traffic comprisingthe steps of: acquiring sequenced packets that are associated with thenetwork communication; feeding a first request packet to a displayengine; acquiring a next sequenced packet; if the next sequenced packetis a response packet produced in response to the first request packet,either: if the next sequenced packet is of a type that may beinterpreted by the display engine, sending the next sequenced packet tothe display engine; or if the next sequenced packet is not of a typethat may be interpreted by the display engine, creating a visualizationof the information in the next sequenced packet and sending thevisualization to the display engine.
 21. The method of claim 20 furthercomprising the step of acquiring additional response packets until allof the packets responding to the first request packet have been acquiredand sent to the display engine.
 22. The method of claim 20 furthercomprising the steps of: attaching a network capture device to anetwork; using the network capture device to capture network packets asthe packets are passed across the network; storing the plurality ofnetwork packets on a mass storage device in chronological order; andselecting a portion of the captured network packets based on a firstpredetermined set of criteria.
 23. The method of claim 20 furthercomprising the step of sequencing selected packets from a networkcommunication using a predetermined process.
 24. The method of claim 23wherein the predetermined process comprises the steps of: (a) decoding afirst packet from the selected packets; (b) if the first packet relatesto a request or to a response, adding the packet to a sorted listcorresponding to a second predetermined set of criteria that aresatisfied by the packet; and (c) repeating steps (a) and (b) onadditional captured packets until all packets relating to the firstpredetermined set of criteria have been sequenced.
 25. The method ofclaim 23 wherein the predetermined process comprises the steps of:reading a first selected packet; determining whether the first selectedpacket meets a second predetermined set of criteria; if the selectedpacket meets the second predetermined set of criteria, determiningwhether the packet is out of sequence; if the packet is not out ofsequence, sending the packet to the simulation engine; if the packet isout of sequence, adding the packet to a temporary store; repeating thesteps of reading packets, determining whether the second set of criteriais met, and sending the packets to the simulation engine or addingout-of-sequence packets to the temporary store; as packets in thetemporary store fall into proper sequence, sending the properlysequenced packets to the simulation engine; and each time a packet isadded to the temporary store, testing the temporary store for anoverflow condition and, if an overflow condition is detected, generatingan error message.
 26. The method of claim 20 further comprising thesteps of: acquiring additional request packets from the sequencedpackets; and repeating the steps of acquiring sequenced packets andsending the sequenced packets to the display engine until all of thepackets responding to the additional request packets have been sent tothe display engine.
 27. The method of claim 20 further comprising thestep of using the display engine to display a visual representation ofat least a portion of the network communication on a computer monitor.28. The method of claim 20 further comprising the step of using thedisplay engine to display on a computer monitor at least one of: ahexadecimal representation of the content of at least one packet; adecode of at least one packet; a listing of packets associated with thenetwork communication; a graphic representation of request and responsepackets associated with network communication; and a composite visualreconstruction of any text or graphic information contained in at leastone packet.
 29. The method of claim 27 further comprising the step ofproviding a user with a means of controlling the display of the networkcommunication.
 30. The method of claim 27 further comprising the step ofpermitting a user to control the display the network communication byselecting a command to implement at least one of the followingoperations: playing display pages in chronological order; playingdisplay pages in chronological order using a predetermined timingsequence; stopping the playing of display pages; going to a next displaypage; going to a previous display page; going to a first display page;going to a last display page; or going to a user-selected display page.